fix: update filtering internal endpoints in ZAP (#2055)

This commit is contained in:
Nanne Baars 2025-03-08 12:40:09 +01:00 committed by GitHub
parent 3b3933b69e
commit 641f24df9d
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 3 additions and 20 deletions

View File

@ -1,24 +1,7 @@
==== Setting up browser
If you use the latest ZAP version (>= 2.8.0), you only need to start ZAP and click the browser button to be able to proxy, see image below:
{nbsp} +
image::images/zap-browser-button.png[ZAP Start,style="lesson-image"]
{nbsp} +
In the browser type: http://localhost:8080/WebGoat, you should see WebGoat and the OWASP ZAP Heads On Display (if you use OWASP ZAP as the proxy):
{nbsp} +
image::images/loginscreen.png[Browser with HUD,style="lesson-image"]
{nbsp} +
You might notice that this is the Dutch login screen. The browser determines the language settings. For some pages, there will be some local translations. You can contribute to WebGoat and add more for your preferred language. You can disable the Heads On Display by clicking on the highlighted button. You can learn about the OWASP ZAP HUD on their website. For now, we recommend disabling it as it kind of blocks the menu items.
You should see the following in OWASP ZAP on the history panel:
As the ZAP setup for proxying localhost varies based on your browser, we recommend following the instructions at: https://www.zaproxy.org/docs/desktop/start/proxies/
After you setup the proxy, you should see the following in OWASP ZAP on the history panel:
{nbsp} +

View File

@ -17,7 +17,7 @@ And in the `URL Exc Regex` box type:
[source]
----
.*lesson.*.mvc
.*lesson.*.mvc.*
----
Click 'Apply to close the window, and ZAP will now no longer show internal WebGoat requests.

Binary file not shown.

Before

Width:  |  Height:  |  Size: 67 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 88 KiB